{"thread":{"id":"26908","subject":"denyNonFastForwards & co fail outside refs/<heads,tags>","startedAt":"2011-03-29T11:54:00Z","lastAt":"2011-03-29T23:59:19Z","messageCount":2,"participants":["Hallvard B Furuseth","Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"164561","messageId":"hbf.20110329j1zo@bombur.uio.no","threadId":"26908","inReplyTo":null,"subject":"denyNonFastForwards & co fail outside refs/<heads,tags>","fromName":"Hallvard B Furuseth","fromEmail":"h.b.furuseth@usit.uio.no","sentAt":"2011-03-29T11:54:00Z","receivedAt":"2011-03-29T11:54:00Z","isPatch":false,"sender":{"key":"h.b.furuseth@usit.uio.no","avatar":null},"body":"config options receive.<denyNonFastForward, denyDeletes> do not work in\nnonstandard ref namespaces.  I stumbled over it in refs/notes/, but the\nproblem is general.  Or if it this intentional, it is the git-config(1)\ndoc of these options which needs fixing.\n\nGit version 1.7.4.2.\n\n\nTo reproduce:\n\n########################################################################\n#!/bin/sh\nrm -rf hi ho\n\ngit --version\n\n# Create initial repos\ngit init -q hi\n(cd hi\n    git config receive.denyDeletes         true\n    git config receive.denyNonFastForwards true\n    echo foo > foo && git add foo && git commit -q -m first foo)\ngit clone -q hi ho\n\n# Make them diverge, except the checked-out branch\nfor r in hi ho; do\n    (cd $r\n\techo $r >> foo && git commit -q -m next foo\n\tgit update-ref refs/outside/test HEAD\n\tgit checkout -q -b br HEAD^\n\t# Shut up a bit\n\tgit config advice.pushNonFastForward false\n\tgit gc --quiet\n\t# For ssh push\n\tgit update-server-info)\ndone\n\ncd ho\n# Optional; makes no difference\n#git config remote.origin.pushurl localhost:`pwd`/../hi\n\n# Can push test despite 'deny's, fails as expeceted for master:\nfor b in refs/outside/test refs/heads/master; do\n    git push -f origin $b:$b\n    git push -f origin   :$b\n    echo \"\"\ndone\n# Just to check: Pushing the master normal way fails the same way.\ngit push -f origin\n\n\n########################################################################\nOutput:\n\ngit version 1.7.4.2\nTo /tmp/hi\n + 1bb5836...5bf63f8 refs/outside/test -> refs/outside/test (forced update)\nTo /tmp/hi\n - [deleted]         refs/outside/test\n\nremote: error: denying non-fast-forward refs/heads/master (you should pull first)        \nTo /tmp/hi\n ! [remote rejected] master -> master (non-fast-forward)\nerror: failed to push some refs to '/tmp/hi'\nremote: error: denying ref deletion for refs/heads/master        \nTo /tmp/hi\n ! [remote rejected] master (deletion prohibited)\nerror: failed to push some refs to '/tmp/hi'\n\nremote: error: denying non-fast-forward refs/heads/master (you should pull first)        \nTo /tmp/hi\n ! [remote rejected] master -> master (non-fast-forward)\nerror: failed to push some refs to '/tmp/hi'\n\n-- \nHallvard\n"},{"id":"164643","messageId":"7vy63xo4vc.fsf@alter.siamese.dyndns.org","threadId":"26908","inReplyTo":"hbf.20110329j1zo@bombur.uio.no","subject":"Re: denyNonFastForwards & co fail outside refs/<heads,tags>","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2011-03-29T23:59:19Z","receivedAt":"2011-03-29T23:59:19Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Hallvard B Furuseth <h.b.furuseth@usit.uio.no> writes:\n\n> config options receive.<denyNonFastForward, denyDeletes> do not work in\n> nonstandard ref namespaces.  I stumbled over it in refs/notes/, but the\n> problem is general.  Or if it this intentional, it is the git-config(1)\n> doc of these options which needs fixing.\n\nI think it is very deliberate that denyNonFastForward does not check\nanything outside local branch namespace, because there may not even be\nancestry relationship between the object a tag currently points at and the\nnew object the tag is trying to update (think: a tag can point at a tree\nor a blob) and more importantly because pushing into refs/remotes/origin/*\nnamespace (which is the right way to simulate a \"git fetch\" from the\nrepository with a \"git push\" from outside into the repository in a\nfirewalled environment where you cannot initiate a connection in one\ndirection) should be allowed (just like \"remote.*.fetch\" line in\n.git/config get a leading plus sign '+' by default).\n\nI suspect that the restriction on deny_deletes was inherited by a mindless\ncut & paste from the deny_non_fast_forwards codepath; I don't think of a\nsane rationale to justify the limitation offhand, other than \"it has been\nwide open since November of 2008 and people may now be relying on that\".\n"}]}